diff --git a/dev/api-gateway/externalsecret-control-plane.yaml b/dev/api-gateway/externalsecret-control-plane.yaml
new file mode 100644
index 0000000..1c8482d
--- /dev/null
+++ b/dev/api-gateway/externalsecret-control-plane.yaml
@@ -0,0 +1,34 @@
+# The Control Plane id, delivered to flux-system so gateway-kustomization.yaml
+# can substitute it instead of carrying a hardcoded UUID.
+#
+# Why a second ExternalSecret rather than extra keys on the existing one:
+# substituteFrom requires the Secret to sit in the same namespace as the Flux
+# Kustomization, which is flux-system — a shared, broadly-readable namespace.
+# The Konnect token must never go there. A Control Plane id is not a secret;
+# it is visible in the Konnect UI URL.
+#
+# Terraform writes this path (see konnect-platform). Moving to a new Konnect
+# org then needs no edit here at all.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: catalog-dev-control-plane
+  namespace: flux-system
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: catalog-dev-control-plane
+  data:
+    # Key names are the Flux substitution variables verbatim: substituteFrom
+    # exposes each key as ${KEY}.
+    - secretKey: CONTROL_PLANE_ID
+      remoteRef:
+        key: kong-v2/catalog/dev/control-plane
+        property: CONTROL_PLANE_ID
+    - secretKey: CONTROL_PLANE_NAME
+      remoteRef:
+        key: kong-v2/catalog/dev/control-plane
+        property: CONTROL_PLANE_NAME
diff --git a/dev/api-gateway/gateway-kustomization.yaml b/dev/api-gateway/gateway-kustomization.yaml
index 47b8a9c..314d24a 100644
--- a/dev/api-gateway/gateway-kustomization.yaml
+++ b/dev/api-gateway/gateway-kustomization.yaml
@@ -23,7 +23,6 @@ spec:
     substitute:
       NAME: catalog-dev
       NAMESPACE: catalog
-      CONTROL_PLANE_ID: "7a1e7127-0a02-4d09-b1dd-2efc865e9e97"
       HOSTNAME: catalog-dev.sttlab.local
     # Cluster-wide defaults only — the Konnect PAT is NOT handled via
     # substitute/substituteFrom at all: that mechanism requires the source
@@ -35,3 +34,9 @@ spec:
     substituteFrom:
       - kind: ConfigMap
         name: dataplane-template-defaults
+      # CONTROL_PLANE_ID comes from Vault via ESO instead of being hardcoded
+      # here: a new Konnect org then needs no edit in this repo. Not a secret —
+      # the id is visible in the Konnect UI URL — so flux-system is fine for it,
+      # unlike the token.
+      - kind: Secret
+        name: catalog-dev-control-plane
diff --git a/dev/api-gateway/policies-kustomization.yaml b/dev/api-gateway/policies-kustomization.yaml
index e0a2c62..1c391d4 100644
--- a/dev/api-gateway/policies-kustomization.yaml
+++ b/dev/api-gateway/policies-kustomization.yaml
@@ -19,13 +19,10 @@ spec:
     substitute:
       NAME: catalog-dev
       NAMESPACE: catalog
-      # Looked up manually after gateway-kustomization.yaml's
-      # Gateway/GatewayConfiguration first reconciled — the operator
-      # auto-names the mirrored KonnectGatewayControlPlane with a random
-      # suffix, not derivable from NAME. See
-      # dataplane-globalpolicy-template/global-policies-pluginbindings.yaml's
-      # comment. Automate this lookup once the self-service pipeline exists.
-      CONTROL_PLANE_REF_NAME: catalog-dev-bkphl
+      # Stable by construction: the mirror CR is declared with this derived
+      # name in k8s-platform/dataplane-template/controlplane-mirror.yaml, so
+      # it no longer has to be looked up after each Gateway reconcile.
+      CONTROL_PLANE_REF_NAME: catalog-dev-cp
       # Every audience valid anywhere in the catalog domain — grows as the
       # domain gains APIs.
       JWT_AUDIENCE_WHITELIST: '["catalog-api", "mcp-catalog"]'